[Entrpi]

Follow-up to #8229 (merged) under decision D3, decided on #7477: option 1, a written calling-convention policy per ABI, ilp32 first, then ilp32f. This PR adds the ilp32f row. Review from 244c42306, the first commit: it records the row in the policy table and the decision record, and ilp32f sessions stay refused until the next commit implements it in the bridge.

Part of the embedded firmware roadmap #7955.

Summary

ESP32-P4, H4 and S31 builds use the single-float ABI ilp32f, which REA refused at the RISC-V lane's float-ABI check. Ghidra's RV32 compiler specification models ilp32d, which passes a double in a float register. Limiting its float entries to 4 bytes is not enough: measured on Ghidra 12.1.4, that still joins struct { float; int; } into a1:a0, where ilp32f passes the float in fa0 and the integer in a0. With this PR, ELF32 images that declare ilp32f and the F extension open in a new lane with a derived __rea_ilp32f prototype, and every argument of the fixture's calls sits where LLVM put it.

rea function h4.elf rea_riscv_abi_single_caller --provider ghidra --json

opens images whose Tag_RISCV_arch lists only extensions that Ghidra 12.1.4 decodes, such as builds with ESP-IDF 5.5's -march for the preview ESP32-H4, rv32imafc_zicsr_zifencei. Images that also declare B, Zcb/Zcmp/Zcmt or an Espressif vendor extension stay refused, and the refusal names those extensions. As of ESP-IDF v6.1, that includes every ESP32-P4 build (xesploop and xespv, plus xesppie on 5.5 before rev 3) and the 6.x builds for H4 (B and xespdsp) and S31 (xesploop and xespv). One prototype cannot express every ilp32f shape on Ghidra 12.1.4, so when an image's typed signatures use a shape __rea_ilp32f would misplace, REA refuses its analysis and names up to eight signatures.

Closes #7477. Refs #8229, #2063. Coordinates with #4811 (RISC-V PIE), which edits the same admission and profile functions.

Decision record: the ilp32f row of D3

D3 is decided on #7477; this row is the follow-up it names. docs/ghidra-riscv.md#ilp32f keeps the full policy.

• Choice.
  • Lane elf32-exec-le-single-float-generic-v1, policy ilp32f-prototype-v1, prototype __rea_ilp32f, on the pinned RISCV:LE:32:default language with gcc. Admission also requires f in Tag_RISCV_arch.
  • __rea_ilp32f is one more row of feat(ghidra): admit RISC-V ilp32 ELF with a derived calling convention #8229's derivation in ReaGhidraRiscvCallingConvention.java. It limits the default float entries to 4 bytes, keeps fs0–fs11 preserved and keeps the shared rule that passes values of 9 bytes or more by reference. One new rule gives structures of up to 8 bytes Ghidra 12.1.4's join_dual_class with fillalternate: each 4-byte part that holds one float takes a float register, and each other part an integer register.
  • That rule decides by 4-byte part, not by the psABI's flattened fields. So it also splits struct { float; short; short; }, a float beside a pointer or a union (LLVM passes these in integer registers), and it cannot place _Float16 or a packed or over-aligned float structure. After assigning the prototype, the script compares the storage class it gives each signature type, as a first argument and as a return, with the psABI's, for every typed function and function-pointer type. If any differ, the bridge reports {policy, refused} with every count and up to eight shortened signatures, and REA refuses the session with that reason. Flattening follows the compilers: a nonzero array of empty C++ classes and a flexible array member, wherever it starts, use the integer convention, as does a GNU vector passed directly, a bit-field counts by its width rather than its declared type, and each array element type is classified once. Ghidra imports a trailing [0] array like a flexible one, so that shape is refused too. A value whose fields hold up to 8 bytes, whatever padding alignment adds, and include a type Ghidra left untyped, such as float _Complex, is refused, because Ghidra's import gives an encoding it does not map an untyped byte, word, dword or qword. A C++ class with a non-trivial copy constructor or destructor is not detected or refused: Ghidra keeps only its fields and GCC's DWARF does not record the rule, so sessions state it as a limitation. ilp32f sessions also state two types whose distinction Ghidra's import erases: a GNU vector inside a structure, and _Atomic(float), which GCC 14.2 places as the policy does and Clang 19 does not.
  • The lane refuses Tag_RISCV_arch that declares d or zcd: ilp32f then preserves only the low 32 bits of fs0–fs11, and Ghidra's model preserves all 64.
• Alternatives (and what switching to each would take):
  • join_dual_class without the check: those signatures would get wrong storage without notice.
  • Correct typed functions with custom storage instead of refusing: more images are admitted, but the script becomes a second psABI allocator in Java, and a function and a pointer to it get different answers, because a function-pointer type cannot carry storage. Switching needs a new policy id.
  • Admit such images with the misplaced signatures marked unverified: the later widening. It admits images refused now and adds a per-signature limitation to the contract.
  • Keep refusing ilp32f: the lane row becomes a refusal again.
• Costs of changing it. Code: S; one table row and its derivation row, plus the comparison. Once released, the single-float lane id and ilp32f-prototype-v1 persist in sessions, snapshots and Evidence; a changed derivation ships as a new policy id that invalidates that lane's snapshots only. Verification: npm run verify:ghidra:riscv.

Problem and expected behavior

• Before: ELF32 e_flags 0x3 was refused: "…the single-float ABI (ilp32f) declared by e_flags has no verified calling-convention policy."
• After: ELF32 single-float images that declare F and only decoded extensions are admitted with __rea_ilp32f; without F they are refused before any provider starts. An image whose signatures __rea_ilp32f would misplace opens, and its analysis is then refused with the signatures named. ilp32 and double-float behaviour and identity are unchanged.

Change and scope

1. 244c42306: the ilp32f row of the decision record and policy table (with the required F), the session-report schema for {policy, refused}, docs, and fixture source with single-float-only shapes and a refused variant. ilp32f images pass admission, but until the next commit the bridge rejects the new policy id, so REA still refuses their sessions.
2. 88c82b88a: the bridge row, its self-check (a float, double, two-float and float-and-int signature, and fs0–fs11 preserved), and the comparison with the psABI.
3. 4f97b9202: the real lane: typed and stripped builds with ESP-IDF 5.5's ESP32-H4 -march, a refused unmodelled build, per-ABI storage tables, a call-site oracle that follows fa registers and per-byte stack memory, and header mutations.
4. 6940199b4: the ilp32f limitation tests check facts, not wording.
5. Merges of feat(ghidra): admit RISC-V ilp32 ELF with a derived calling convention #8229's heads (51419dca5, 5fd177413, 688c1d567, 2db1fa8a9); 688c1d567 takes feat(ghidra): admit RISC-V ilp32 ELF with a derived calling convention #8229's stripped return-storage check and records ilp32f's two stripped returns that differ (tagged at a0:4, flagged at a0:1). Merges of main up to d3ab0faf5 (8acebd1f4, a5c020aae, ba174afe6, bfef6976b); a5c020aae records feat(ghidra): admit RISC-V ilp32 ELF with a derived calling convention #8229's squash e669365c3 with -s ours, after checking that its git patch-id --stable equals that of d8ae325f1's own patch.

Not included: the shapes the check refuses (above); quad-float, RVE, TSO, ELF64 soft- or single-float, ET_DYN (#4811); and images that declare undecoded extensions (above).

Contract and boundary impact

• Semantic owner and earliest changed stage: feat(ghidra): admit RISC-V ilp32 ELF with a derived calling convention #8229's owners (src/domain/riscvIsaDeclaration.ts, the tables in src/ghidra/GhidraRiscvProfile.ts, bridge/ghidra/ReaGhidraRiscvCallingConvention.java). The earliest changed stage is Ghidra admission: the lane row and its required F.
• Contribution scope fit and linked maintainer decision: static analysis in the existing Ghidra RISC-V lane; no target execution, injection, mutation or protection recovery. No maintainer scope decision is required for static analysis in an existing lane (CONTRIBUTING); design decision D3, which names ilp32f as its follow-up, is recorded on [Design] Admit RISC-V ilp32 and ilp32f ELF in the Ghidra lane with a per-ABI calling-convention policy #7477.
• CLI and MCP/tool-catalog contract: no new inputs or tools. ELF32 single-float images are admitted. New refusals: "Tag_RISCV_arch declares … without f, which the single-float ABI (ilp32f) declared by e_flags requires." before any provider starts, and, from the first analysis call, "RISC-V calling-convention policy ilp32f-prototype-v1 refused this image, so REA does not serve its analysis: … See docs/ghidra-riscv.md." The ELF32 float-ABI refusal now lists three admitted ABIs. A failed calling-convention handshake, MIPS soft-float included, now also carries its reason as the error's userMessage, not only as diagnostics.reason.
• Provider, bridge, target-format, or platform compatibility: Ghidra on Linux and macOS (RISC-V is outside Windows Ghidra P0). The bridge script gains the ilp32f row; its session report may carry a refusal of at most 2,048 characters.
• Evidence, artifact, provenance, or reconstruction contract: single-float profiles carry riscv_elf.float_abi: "single", riscv_elf.arch and riscv_calling_convention: ilp32f-prototype-v1; session Evidence states the prototype and its counts. ilp32 and double-float profiles are unchanged (tested).
• Target selection, authority, upstream behavior, and cleanup details: as in feat(ghidra): admit RISC-V ilp32 ELF with a derived calling convention #8229. A refused policy ends the session before any analysis is served, with the normal cleanup.
• Generated metadata (docs/public/product-catalog.json), package, or installation impact: none; the bridge source already ships.

Expected effects:

• Read existing files or captured data.
• Launch or attach to a process. (Ghidra, as before.)
• Inject instrumentation or run scripts/code. (REA's fixed Ghidra scripts, as before; no target execution.)
• Change process memory, registers, files, or configuration.
• Contact network services.
• Recover protected code or work around protections.
• Documentation or usability only; no target interaction.
• Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

• Tests added or updated: four test files; per-file coverage below.
• Base reproduction or other evidence: source-derived, main refuses ELF32 e_flags 0x3 ("no verified calling-convention policy"). Measured on Ghidra 12.1.4 (recorded in feat(ghidra): admit RISC-V ilp32 ELF with a derived calling convention #8229's docs): 4-byte float entries alone put struct { float; int; } in a1:a0. The conformance checks refuse the stock model's placements: a whole double in fa0, and that structure joined into an integer pair.
• User-visible CLI/MCP output: below, from the CLI on this PR's head.
• Remaining proof gaps: no real-Ghidra run on macOS or Windows; no image built by GCC or ESP-IDF itself (the fixtures are LLVM builds with ESP-IDF 5.5's ESP32-H4 -march). A GNU vector inside a structure and Clang's _Atomic(float) get wrong storage, which every ilp32f session states as a limitation. The stock double-float lanes still show float _Complex as an integer. The compiler placements of the new shapes come from one-off GCC 14.2 and Clang 19 builds; the lane builds with LLVM only.

Per-file test coverage (counts on the head)

• src/ghidra/GhidraRiscvProfile.test.ts (66 tests): the single-float lane row and where F is required; ilp32f admission and its refusals; the single-float profile's exact parameters; the stated ABI, prototype and ISA; and the launch with the single-float policy and its outcome.
• src/ghidra/GhidraSessionValues.test.ts (40 tests): the ilp32 and ilp32f outcomes and an ilp32f refusal accepted. Refused: an unknown policy, a custom-storage count, an ilp32 refusal, a refusal with counts, and an empty or unbounded refusal.
• tests/boundary/providers/ghidra/ghidraLauncher.test.ts (59 tests, 3 Windows-only skipped): the post-script for both policy ids.
• tests/conformance/ghidra/riscv-checks.test.ts (12 tests): per-ABI tables and the call-site oracle across both callers, with fa registers, halfword stores and sub-word stack words. Also ilp32f storage, refusing a float-and-integer structure the wrong way round, the stock pair and a whole double in fa0. Stripped storage with ilp32f's recorded exceptions, refusing a stripped pair return that loses its high word. Both callers' pseudocode, refusing an unaccounted register value.

CLI output on this PR's head

For the single-float build of the fixture (-march=rv32imafc_zicsr_zifencei -mabi=ilp32f), the committed profile:

{"language_id":"RISCV:LE:32:default","compiler_spec_id":"gcc",
 "riscv_support_lane":"elf32-exec-le-single-float-generic-v1",
 "riscv_calling_convention":"ilp32f-prototype-v1",
 "riscv_elf":{"elf_class":32,"byte_order":"little","type":2,"flags":3,
   "float_abi_double":false,"rvc_declared":true,"rve_declared":false,
   "tso_declared":false,"float_abi":"single",
   "arch":"rv32i2p1_m2p0_a2p1_f2p2_c2p0_zicsr2p0_zifencei2p0_zmmul1p0"}}

Excerpts of both callers' pseudocode:

local_10 = rea_riscv_abi_pick(1.5,2.5,sel);
local_20 = rea_riscv_abi_mixed(local_c,4.75,5.5,6.125);
rVar2 = rea_riscv_abi_pair((rea_riscv_abi_pair)0x4118000041080000,10.5);
rVar3 = rea_riscv_abi_tagged((rea_riscv_abi_tagged)0xc41380000,local_c);
rVar2 = rea_riscv_abi_flagged((rea_riscv_abi_flagged)0x41b400000000002a,23.5);
fVar1 = rea_riscv_abi_fill(1.0,2.0,3.0,4.0,5.0,6.0,7.0,8.0,(rea_riscv_abi_tagged)0x1c41dc0000,29.5
                          );
rVar3 = (*rea_riscv_abi_tagged_callback)((rea_riscv_abi_tagged)0x2041fc0000,sel);

The limitations include "RISC-V calling-convention outcome: 16 functions and 16 function definitions use __rea_ilp32f." The same source built with REA_RISCV_ABI_UNMODELLED opens, and its first analysis call fails. On ef3ea15bb the lane checks that the reason counts "7 functions and 1 function-pointer type", names rea_riscv_abi_spread, rea_riscv_abi_half, rea_riscv_abi_flexible, rea_riscv_abi_padded, rea_riscv_abi_vector, rea_riscv_abi_complex, the C++ rea_riscv_abi_empties and the function-pointer type, and does not name rea_riscv_abi_elements or the bit-field function rea_riscv_abi_bits. On bfef6976b, before those shapes were added, it read:

{"code":"execution_failure",
 "message":"RISC-V calling-convention policy ilp32f-prototype-v1 refused this image, so REA does not serve its analysis: 2 functions and 1 function-pointer type pass by-value types whose psABI storage __rea_ilp32f cannot express: rea_riscv_abi_spread (returns rea_riscv_abi_spread, rea_riscv_abi_spread); rea_riscv_abi_half (returns _Float16, _Float16); function-pointer type _func_void_rea_riscv_abi_spread_int (rea_riscv_abi_spread). See docs/ghidra-riscv.md."}

For evidence-bearing changes:

• Observed, derived, and inferred claims remain distinguishable.
• Artifact identity, source provenance, and failed attempts remain preserved.
• Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

On the head cca443532, which walks each field type once: npm run verify:ghidra:riscv and verify:ghidra:bridge-sources passed in a Linux container (Ghidra 12.1.4), "mocked": false, cleanup complete. npm run check:fast, format:check, docs:check, knip and the 4 test files this PR changes (175 passed, 3 skipped) passed. With a temporary, uncommitted chain of 29 nested structures, verify:ghidra:riscv took 442 s on the earlier walk and 385 s on this one, one run each. CI passed on this head.

On c6345b0d7, which refuses an untyped value that alignment pads past 8 bytes: npm run verify:ghidra:riscv and verify:ghidra:bridge-sources passed in a Linux container (Ghidra 12.1.4), "mocked": false, cleanup complete. The lane checks that the reason names the over-aligned rea_riscv_abi_aligned, still counts 7 functions, and does not name rea_riscv_abi_complexes, whose two float _Complex fields pass by reference. With the old guard and this fixture the lane fails, because the reason leaves out rea_riscv_abi_aligned. npm run check:fast, format:check, docs:check, knip and the 4 test files this PR changes (175 passed, 3 skipped) passed. CI passed there.

On 7f54acacb, which merges main 71f680d7c without conflicts: npm run verify:ghidra:riscv and verify:ghidra:bridge-sources passed in the same container, "mocked": false, cleanup complete. npm run check:fast, format:check, docs:check, knip and the same 4 test files passed. CI passed there; it did not run on 808271a78, for a reason not established.

On ef3ea15bb, which closes the review findings after 042d25f94 in c6659e329 and refuses untyped values (808271a78 after it changes docs/ghidra-riscv.md only, and docs:check passed there): npm run verify:ghidra:riscv and verify:ghidra:bridge-sources passed in a Linux container (Ghidra 12.1.4), "mocked": false, cleanup complete. The lane's header-mutated double-float image, now declared ilp32f, is refused for its d. npm run check:fast, docs:check and three test files (Ghidra RISC-V profile, session values, conformance checks; 119 tests) passed. The same lane failed without each fix: with the fixture ahead of the bridge change, the reason did not name rea_riscv_abi_padded or rea_riscv_abi_vector on 042d25f94's bridge, or rea_riscv_abi_complex on c6659e329's.

On 042d25f94, which adds the hidden-reference limitation to 0933597de: npm run check:fast and docs:check passed, and 15 files of the Ghidra RISC-V profile, session-value, provider-client and conformance-check tests passed (684 passed, 3 skipped).

On 0933597de, which fixes the review findings in the flattener and the refusal after 87fdfc89d merged main c3647ade1 without conflicts: npm run verify:ghidra:riscv and verify:ghidra:bridge-sources passed in a Linux container (Ghidra 12.1.4), "mocked": false, cleanup complete, process lineage verified with no descendants. Source-derived: on bfef6976b the empty-class and flexible shapes are admitted and the bit-field shape is refused, so those checks would fail there; that was not run.

On bfef6976b, which merges main d3ab0faf5. main moved the real-toolchain lanes section to docs/testing-lanes.md, so the verify:ghidra:riscv row that names the ilp32f fixtures moves there unchanged.

• macOS arm64 (Darwin 25.5.0), Node 24.22.1:
  • npm run check:fast and docs:check — passed. format:check fails only on 16 files that this PR does not change; they are byte-identical to main, whose own CI fails the same way.
  • npm run test:focused -- 17 files: the test files this PR changes and the Ghidra tests that main changed — 590 passed, 3 skipped.
• Real Ghidra 12.1.4 in the Debian 13 container described below: npm run verify:ghidra:riscv — passed ("mocked": false, cleanup complete).

The checks below ran on the previous head ba174afe6, which merges main 6e9ee97a6.

• macOS arm64 (Darwin 25.5.0), Node 24.22.1, npm 11.19.1:
  • npm run check:fast, format:check, docs:check (built steps executed) and verify:module-boundaries — passed.
  • npx knip — one finding, the unused exported type DarwinHelperCache (src/process/DarwinHelperCache.ts:465). knip on a built main 6e9ee97a6 prints the same output, so this PR adds none.
  • npm run test:focused -- 22 files: the 4 test files this PR changes, the other RISC-V test files, and tests of the code it shares with main's latest changes — 948 passed, 4 skipped (Windows-only).
• Real Ghidra 12.1.4 in a Debian 13 container (Linux x86_64; OpenJDK 21.0.12, Node 24.22.1, Debian's LLVM 19.1.7; npm ci --ignore-scripts), on ba174afe6:
  • npm run verify:ghidra:bridge-sources — passed: javac 21.0.12 compiles all 11 bridge sources against Ghidra's 195 jars.
  • npm run verify:ghidra:riscv — passed for both ABIs: "mocked": false, cleanup complete, process lineage verified with no descendants. The typed ilp32f build has the compiler's storage at all 13 calls of both callers, the stripped builds return where the tables say, and the unmodelled build is refused with its three signatures named. Per fixture below.
  • npm run verify:ghidra:mips — passed, run because this PR changes the shared handshake's failure message: all six fixtures, including the soft-float pair with __rea_soft_float; process lineage verified with no descendants.
• Both hosts' installs differ from the lockfile only in the transitive fast-uri 3.1.8 and qs 6.16.0 (lockfile: 3.1.9 and 6.16.1).
• Not run: real Ghidra on macOS or Windows (the macOS host has no Ghidra 12.1.4, only JDK 25).

Lane results per fixture on ba174af

• RV32 and RV64 double-float: the unchanged lanes. RV32 relabelled 0x1 and 0x3 is admitted over MCP and the CLI through the soft- and single-float lanes; RV64 0x1 (lp64), 0x3 (lp64f) and 0x80000005 are refused.
• RV32 ilp32, typed and stripped (ESP32-C3's -march): unchanged from feat(ghidra): admit RISC-V ilp32 ELF with a derived calling convention #8229. 13 functions, with 12 and 0 function definitions; the soft-float image relabelled 0x3 lacks F and is refused.
• RV32 ilp32f, typed (ESP-IDF 5.5's ESP32-H4 -march=rv32imafc_zicsr_zifencei): the single-float lane and ilp32f-prototype-v1. fence.i, csrr, fmv.w.x and fmv.x.w decode. Every inspect_native_api prototype uses __rea_ilp32f with the table's storage, for example fa0:4,a0:4 for the flagged structure, a0:4,fa0:4 for the tagged one, and the integer pair a1:4,a0:4 for a double. 16 functions and 16 function definitions use the prototype; 0x80000003 is refused.
• RV32 ilp32f, stripped: the same allocated bytes. Ghidra's inferred storage matches the table: one word per location, except the recorded tagged, flagged and fill. Returns are in the typed registers, except tagged at a0:4 and flagged at a0:1, which leave their float in fa0. 16 functions and 0 function definitions.
• Unmodelled build: admitted by its headers, then refused over MCP and the CLI with the bridge's reason, which names its three signatures.
• Call-site oracles: LLVM 19.1.7 llvm-objdump places every expected word for the 10 ilp32 calls and the 13 ilp32f calls, in integer and float registers and on the stack.
• Snapshots save and replay, CLI and MCP agree, and source bytes are unchanged for every fixture.

Compatibility, safety, and release

• Breaking changes or migration steps: none. Admission widens; the changed refusal texts are listed above.
• Real Hopper/Ghidra, browser, or OS coverage: real Ghidra 12.1.4 on Linux x86_64 only; no Hopper.
• Package or release metadata impact: none.
• Security, privacy, process, or containment review: no new authority.

Author readiness

Human owner: @Entrpi

• I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
• I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
• I declare this PR ready for initial maintainer review.

Before merge

• This PR addresses a concrete problem or an agreed enhancement.
• Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
• The PR has one focused outcome and the title follows type(scope): outcome.
• Related issue is linked, or the reason for not linking one is stated above.
• Tests cover changed observable behavior and meaningful failure paths.
• Owning docs, contracts, and generated metadata are updated where needed.
• User-visible CLI/MCP changes include representative output.
• I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

[greptile-apps]

Confidence Score: 4/5

[Medium impact] The PR changes analysis behavior in Ghidra's RISC-V lane and exposes calling-convention refusal reasons to Ghidra callers.

Cache the new padding walks before merging to meet the repository's performance requirement.

Findings

1.  Nested types repeat startup work ▶

Fix with agent prompt

### Issue 1
bridge/ghidra/ReaGhidraRiscvCallingConvention.java:554-560
For a chain of structures wrapping one `float`, `unexplainedBytes` calls `naturalAlignment` on every remaining chain. Doubling the nesting depth roughly quadruples this work during startup. `heldFields` does not cache either new result.

Cache both results per stripped `DataType`, or compute them with the existing per-type facts. This must be addressed before merging to satisfy the repository directive: “Avoid unnecessary work and copies.”

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds an ELF32 single-float lane using __rea_ilp32f.

• Eligible ELF32 single-float images use a derived Ghidra calling convention.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[ELF32 single-float image] --> B{ISA declarations fit?}
  B -->|No| C[Refuse before launch]
  B -->|Yes| D[Run Ghidra analysis]
  D --> E[Install __rea_ilp32f]
  E --> F[Compare typed signatures]
  F --> G{Any misplaced or unknown type?}
  G -->|Yes| H[Report refusal and close session]
  G -->|No| I[Serve analysis]

Loading

_{Reviews (13) · Last reviewed commit: "fix(ghidra): refuse ilp32f values whose ..." · Reviewed by Greptile}

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T04:26:30.800788Z	719f3d2	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ba174afe69

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Entrpi]

Disclosure: this PR's H4 evidence was measured while Ghidra 12.1.4 loaded ESP-IDF's .flash.text into an overlay address space, which its DWARF import does not reach (#8461). The signature refusal check therefore saw DWARF types for IRAM functions only: 272 of H4's 278 DWARF-described flash functions had no imported signature. The fix, #8464, moves flash code into the default address space; once it lands, this branch will merge it and measure H4 again.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[morluto]

Hey @Entrpi, thanks for this! The addition looks good. What's left: there is 1 unresolved review thread from Greptile, about "Padded complex arguments slip through". Greptile is at 4/5 on the current head, mainly over "Padded complex arguments slip through", so addressing that thread should bump it. Happy to get this in once that's sorted out.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[Entrpi]

Thanks! The padded-complex thread is fixed in c6345b0d7, and cca443532 fixes a follow-up Greptile found in that change. Both threads are resolved, Greptile is at 5/5, and CI passed on cca443532.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 82a28e59ad

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 823083f8c6

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[CassieFox23]

TL;DR: I ran the 4 changed test files on head 823083f under three Node versions. All 4 files passed each time, with 175 tests passed and 3 skipped. In CI, one test failed in a file this PR does not change. I did not run the real Ghidra check.

Check	Node 22.23.4	Node 24.22.1	Node 26.12.1
Test Files	pass, 4 passed (4)	pass, 4 passed (4)	pass, 4 passed (4)
Tests	pass, 175 passed, 3 skipped (178)	pass, 175 passed, 3 skipped (178)	pass, 175 passed, 3 skipped (178)

The 4 files are src/ghidra/GhidraRiscvProfile.test.ts, src/ghidra/GhidraSessionValues.test.ts, tests/boundary/providers/ghidra/ghidraLauncher.test.ts and tests/conformance/ghidra/riscv-checks.test.ts.

The PR changes 18 files against the merge base. That is 4 test files and 14 others. I ran only the 4 test files.

The head is 2 commits behind main b46f4fc. GitHub shows mergeable true and state blocked.

CI on the head, read live with gh:

• Workflow runs: CI is in_progress. CodeQL production is completed/skipped. PR readiness is completed/success. PR title is completed/success.
• Check runs, failure (2): Test shard (2/8) and Portable tests. Test shard (7/8) is cancelled, and CI required is in_progress.
• The Test shard (2/8) log has one failure, preserves the source when an inline result with unknown retention exceeds delivery. It is in tests/boundary/mcp/sourcePublicationComposed.test.ts, which is not one of the PR's 18 files.
• Check runs, success (22): among them Source tests, Static checks, Build package and six Test shard runs.
• Check runs, skipped: 20 checks.
• Commit status: PR readiness is success.

Not run

• A run of npm run verify:ghidra:riscv on 823083f with Ghidra 12.1.4 and RISC-V clang.
• A merge with current main, b46f4fc.

Test setup

• Box: Fedora 44 VM (4 vCPUs, 8 GB) on my Nobara 44 PC, Linux 7.2.11
• Node: 22.23.4, 24.22.1, 26.12.1
• Head / base: 823083f / c78c8ae (merge base with main)
• Install: npm ci --offline and npm run test:prepare on Node 24.22.1

Commands

npm ci --offline
npm run test:prepare
xvfb-run -a npm run test:focused -- src/ghidra/GhidraRiscvProfile.test.ts src/ghidra/GhidraSessionValues.test.ts tests/boundary/providers/ghidra/ghidraLauncher.test.ts tests/conformance/ghidra/riscv-checks.test.ts

🤖 Written and tested with Claude Code (Sonnet 5.5, verified by Opus 5.5), posted with my OK 🦊

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4748c92459

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Refuse transparent-union parameters after marker erasure

For an ilp32f signature such as typedef struct { float f; } F; typedef union { F f; int i; } U __attribute__((transparent_union));, Clang 17 lowers a U parameter as a float in fa0, while its DWARF formal type is only an ordinary union. This guard therefore assigns psabiKind as INTEGER, and __rea_ilp32f also places the imported union in a0, so misplacedSignatures sees agreement and admits the image with wrong storage; preserve the attribute at import or refuse unions whose erased first-member convention could use float registers.

AGENTS.md reference: AGENTS.md:L19-L19

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 719f3d27dc

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Reject K&R float parameters before applying ilp32f

For an ilp32f binary built from an old-style definition such as float f(x) float x;, Clang 20 passes the default-promoted double in a0/a1 while emitting a float formal DIE and omitting DW_AT_prototyped. This comparison therefore sees FLOAT on both sides, applies __rea_ilp32f's fa0 storage, and admits the session even though every call and entry is decoded from the wrong register file. Preserve the prototype marker at import or refuse unprototyped signatures before this check.

AGENTS.md reference: AGENTS.md:L19-L19

Useful? React with 👍 / 👎.